EU tech regulation, Digital Markets Act, Apple Europe sales, Apple regulation, European Union, Siri AI, iPhone features, device interoperability, App Store changes, alternative marketplaces, iPhone Mirroring, AirPods translation, Apple privacy, iPhone security, app sideloading, platform competition, DMA compliance, Apple Intelligence, European technology, government control
EU tech regulation is no longer limited to App Store payment rules or competition disputes hidden from ordinary consumers. It is beginning to determine which features reach European devices, how quickly they arrive and how deeply third-party companies can interact with the iPhone, iPad and Mac.
The Digital Markets Act was designed to reduce the control of large technology platforms over software distribution, payments, browsers, digital assistants and connected hardware. For Apple, compliance has already produced alternative app marketplaces, web distribution, third-party payment options, additional default-app controls and expanded access to iPhone technologies.
The next phase reaches much deeper into the operating system. European regulators want competing accessories, cloud services and AI assistants to receive access to capabilities traditionally reserved for Apple’s own products.
Apple argues that some of those demands could weaken privacy and security. The European Commission says the company is responsible for creating compliant systems that preserve both competition and user protection.
Between those positions sits a large and commercially significant group of customers. Europe generated $28.06 billion in Apple sales during the quarter ending March 28, 2026, up from $24.45 billion one year earlier. Six-month European sales reached $66.20 billion, compared with $58.32 billion during the same period of fiscal 2025.
Europe therefore represented more than one-quarter of Apple’s latest quarterly revenue. It is too valuable to leave behind, but increasingly difficult to serve with the same software experience available elsewhere.
Regional differences once centered mainly on language support, licensing agreements or local services. EU tech regulation is creating a more structural divide.
Apple has blamed Digital Markets Act requirements for delaying Siri AI across the European Union. The company says regulators expect competing AI assistants to receive extensive access to personal information, apps and device actions before Apple can reserve those capabilities for its own assistant.
The disagreement concerns more than answering questions. Siri AI is designed to read personal context, understand onscreen information and complete actions across apps. That may include finding messages, accessing files, making purchases or sending information on the user’s behalf.
Opening those capabilities to outside AI systems requires new permission structures, technical interfaces and safeguards. Apple says it cannot release its assistant first and add competing access later without risking regulatory action. The Commission says Apple had sufficient time to design an interoperable solution.
Other delayed European features have included iPhone Mirroring on Mac, Live Translation through AirPods and certain location-based Maps capabilities. Each feature touches a different part of the ecosystem, but all depend on privileged communication between Apple devices, software and services.
The consequence is becoming visible at purchase. Two customers can buy the same iPhone model at similar prices and receive different capabilities because one lives inside the European Union.
Delayed availability can weaken the adoption of new hardware features even when the devices themselves continue selling well.
Siri AI is intended to become a central part of newer iPhones, iPads and Macs. Buyers who cannot access it lose part of the justification for newer chips, additional memory and on-device AI processing. Developers also face a smaller addressable audience for apps built around the new assistant.
AirPods Live Translation presents a similar problem. A feature designed to demonstrate the combination of iPhone processing, microphones and wearable audio becomes unavailable in a region built around dozens of languages and frequent cross-border travel.
iPhone Mirroring affects the relationship between iPhone and Mac. Users outside the EU can interact with the phone from macOS, while European users may receive notifications without gaining the complete experience.
These differences do not necessarily stop hardware sales. Apple’s newest results show strong European demand despite years of regulatory conflict. They can, however, reduce the speed at which customers use the ecosystem’s newest capabilities.
The effect may grow as software becomes a larger part of hardware differentiation. A faster processor has limited emotional value when the feature designed to demonstrate it is unavailable.
Apple does not report European Union revenue separately. Its Europe segment also includes countries outside the bloc, along with India, the Middle East and Africa. The official segment remains the best regularly published measure of the region’s commercial weight.
European sales rose approximately 15% year over year in Apple’s latest reported quarter. During the first six months of fiscal 2026, the segment expanded by roughly 14%.
Those figures weaken the argument that regulation is already driving customers away from Apple hardware. Demand remains strong, supported by the iPhone 17 family, Mac sales, services and the company’s installed base.
The financial risk is more gradual. Regional software fragmentation can raise engineering costs, delay launches and make European devices less competitive against products able to offer complete feature sets.
Apple must maintain separate distribution rules, payment systems, browser options and eligibility checks. Developers must decide whether alternative stores, external payments or EU-specific business terms justify additional work. Support teams must explain why features differ between countries using the same operating-system version.
A market responsible for more than $28 billion in one quarter can absorb considerable compliance expense. It can also influence Apple’s global product decisions when regulators demand interfaces that cannot be restricted to Europe easily.
The escalating regulatory environment also creates a more fundamental concern: control over complex technology ecosystems can gradually move away from the companies that designed them and toward government committees, regulatory bodies and administrative processes.
That transfer rarely happens through one dramatic order. It develops through repeated obligations covering app distribution, payment systems, browser engines, digital assistants, hardware access, data portability and interoperability. Each requirement may appear narrow when considered alone. Together, they can redefine who determines how the ecosystem operates.
Apple built its platform around tight integration between hardware, software, services and security. Regulators increasingly treat parts of that integration as market power that must be opened to competitors. The danger is that an ecosystem designed as one coordinated environment becomes subject to decisions made by committees that do not carry direct responsibility for product quality, reliability or long-term maintenance.
This can become a slow trap. Once a platform is required to expose one layer, regulators may use that access as the basis for demanding another. A payment exception can be followed by alternative app stores. Alternative stores can lead to broader installation rights. Device interoperability can expand into access for AI assistants, personal data and system actions.
The boundaries of the platform are then set less by engineering judgment and more by regulatory negotiation.
Government agencies have legitimate authority to address competition and consumer harm. The concern appears when regulation shifts from preventing abusive conduct to directing product architecture. At that point, public authorities begin influencing feature design, release timing, software permissions and the relationship between first-party and third-party services.
That creates consequences beyond Apple. Any company considering a tightly integrated product may decide that deep integration invites intervention. Businesses could avoid building ambitious ecosystems if successful coordination later becomes grounds for forced access.
Innovation then becomes shaped by what regulators are likely to permit rather than by what engineers believe will produce the safest or most coherent experience.
EU policy has produced benefits that Apple rarely emphasizes. Users can install apps through alternative marketplaces or directly from authorized developers. Developers can offer external payment methods, promote different prices and avoid relying entirely on Apple’s distribution system.
Alternative browser engines can compete with WebKit, while users have more control over default apps. Contactless payment access has expanded beyond Apple Pay, allowing competing wallet providers to use the iPhone’s NFC technology under approved conditions.
Interoperability requirements could also improve third-party accessories. Smartwatches, headphones and other devices may gain better notification access, background connectivity and proximity pairing with the iPhone.
These changes can increase competition and reduce the advantage Apple gives its own services and accessories. A third-party smartwatch should not become artificially less useful simply because it was not made in Cupertino.
The difficulty is separating legitimate platform access from unlimited access. A notification interface is one thing. An autonomous AI assistant capable of reading messages, accessing files and acting across apps introduces a different level of sensitivity.
Alternative app distribution increases user choice, but it also moves some responsibility away from the App Store. Apple continues to notarize apps distributed through approved alternative channels, checking for known malware and severe fraud. That process is narrower than a complete App Store review.
Purchases made outside Apple’s payment system also fall outside its normal refund and billing support. Users may need to resolve disputes directly with the developer or payment provider.
A malicious marketplace, deceptive payment page or compromised developer account can create opportunities for fraud. Enterprise users face additional concerns when employees install software from sources their organization has not approved.
The AI question reaches further. A third-party assistant may need permission to access messages, photos, calendars, documents and app controls. Even a reputable provider can collect more information than the user expects or introduce vulnerabilities through poorly designed integrations.
Apple can build permission prompts, app isolation and revocation controls, but technical access always creates some exposure. Security depends on how narrowly permissions are defined, how visibly they are used and whether the operating system can stop unauthorized actions.
The Commission maintains that interoperability and privacy can coexist. Apple maintains that regulators are demanding access before adequate protections are ready. Both positions contain a legitimate concern: dominant platforms should not block competition, and competition should not require users to surrender control of personal data.
When regulators require a company to alter its architecture, responsibility can become blurred.
Apple remains the company customers blame when an iPhone feature fails, a third-party marketplace distributes a harmful app or an outside assistant misuses personal data. Regulators may have required the access, but they do not operate the device, provide technical support or repair the damage to the platform’s reputation.
This creates an accountability gap. Government committees can mandate openness without assuming the commercial and security consequences of that openness. Apple must comply, maintain the system and explain the outcome to users.
The same problem applies to delayed features. Regulators may argue that Apple chose not to release a service, while Apple may argue that the required conditions made the launch unsafe or technically impractical. Customers are left with less functionality and no simple way to determine who caused the delay.
Over time, the ecosystem can become a negotiated compromise rather than a product with one coherent direction. That may satisfy formal compliance while producing a weaker experience for everyone involved.
The risk is not that governments will literally operate Apple’s software. It is that committees increasingly define the conditions under which Apple can design, connect and release its own features. Control shifts through constraints.
The consequences extend beyond one company. Google, Meta, Microsoft, Amazon and other platform operators face related European obligations. Hardware makers must consider whether ecosystem advantages can survive when core services are required to support rivals.
Smaller developers may gain new distribution and payment choices, but they may also inherit more compliance, customer-service and security responsibilities. Accessory companies could compete more effectively while becoming accountable for handling sensitive device data.
Other governments are watching. Rules introduced in Europe can influence legislation elsewhere, particularly when companies decide that maintaining one global technical framework is easier than operating several regional versions.
Apple is unlikely to abandon Europe or stop adapting its products. Its sales provide too much evidence of the region’s importance. The company will continue negotiating, appealing decisions and building compliance systems while withholding features it considers unsafe under current demands.
European customers may receive more app stores, payment choices and accessory compatibility. They may also wait longer for headline features included with the same hardware elsewhere.
The deeper consequence may be a technology industry that becomes more cautious about building tightly integrated products. Companies may design around anticipated regulatory demands from the beginning, limiting exclusive features, reducing private-system integration or avoiding innovations that depend on controlled access.
EU tech regulation began as an effort to constrain dominant platforms. Its long-term effect may be to transfer part of the power to shape those platforms from companies and users to regulatory institutions.
That shift deserves scrutiny equal to the market power it is intended to correct. Competition rules can restrain abuse. They can also become a slow mechanism for placing product design, security choices and ecosystem evolution under government supervision.
The danger grows when regulatory discretion becomes buried beneath permits, approvals, negotiations and technical committees that operate beyond meaningful public scrutiny.
The more power officials hold over which features, contracts or technologies may proceed—and when—the greater the opportunity for lobbying, favoritism and selective enforcement to influence outcomes. What begins as oversight can gradually become a system in which delay itself is leverage, while responsibility disappears inside layers of administration.
For the technology industry, that risks replacing transparent product decisions with political access, negotiated exceptions and regulatory influence exercised far from the consumers expected to live with the consequences.
The post EU Tech Regulation Creates a Costly Split for Apple appeared first on AppleMagazine.
NHS England has launched a nationwide campaign warning staff that accessing patient records without proper legal justification could end their careers.
The initiative includes screensavers and posters across NHS organisations reminding workers not to let curiosity override professional and legal boundaries.
Staff who breach these confidentiality rules risk disciplinary action, dismissal, regulatory referral, or even imprisonment under existing data protection legislation.
The campaign follows several recent dismissals linked to staff who unlawfully viewed records connected to victims of high-profile crimes nationwide.
NHS England specifically cited unlawful access incidents involving the 2023 Nottingham attacks and the 2024 Southport knife attack, both of which drew significant national attention.
“Patients must be able to trust that their personal information is kept confidential by the NHS – any instance of staff looking at records without a valid reason is wholly unacceptable, a disgraceful breach of patients’ trust and against the law,” said Sir Jim Mackey, NHS Chief Executive.
He added that most staff manage patient information appropriately, although a limited group has seriously damaged that confidence through inappropriate access.
New guidance has now been issued outlining different categories of unlawful access, alongside advice on monitoring and conducting regular audits.
Some newer electronic patient record systems can reportedly flag suspicious activity in real time, helping organisations identify unauthorised access quickly.
Breaches can be reported to both the Information Commissioner's Office (ICO) and police, who may pursue criminal prosecution under the Data Protection Act 2018.
The ICO reiterated the expectations of patients and staff, as well as the consequences of this illegal action.
“When people seek medical care, they share some of their most sensitive personal information in the trust that it will be kept safe,” said Paul Arnold, Chief Executive of the ICO.
“Unauthorised access to those records is not just a breach of data protection law — it is a betrayal of that trust, with real and lasting consequences for patients and their families…Staff who breach that trust face serious consequences: loss of employment, removal of professional accreditation and criminal prosecution.”
The temptation to access patient records unlawfully often increases when cases attract widespread public attention.
"When a local incident becomes national news – a serious crime, a public tragedy, a story that captures widespread attention – there is an increased risk that healthcare staff could be tempted to look at records they have no reason to view," Arnold added.
“Anyone considering accessing records for personal reasons or out of curiosity should be in no doubt they could be putting their career at risk, and may face disciplinary action, dismissal, referral to the regulator or even time in prison,” said Sir Jim Mackey.
Findings show that 18 staff members at York and Scarborough Teaching Hospitals wrongfully accessed patient records since 2021.
Eight of those 18 cases were subsequently referred onward to the ICO for further formal investigation.
Another investigation began after up to 40 staff members reportedly accessed the medical records of a three-year-old boy injured in a crocodile enclosure incident near Huntingdon.
Cambridge University Hospitals said restrictions had already been placed on the child's records and confirmed any staff lacking legitimate clinical or operational reasons would face disciplinary action, including dismissal.
Offences under the Data Protection Act 2018 and Computer Misuse Act 1990 can carry fines and prison sentences for those convicted.
The scale of these repeated incidents suggests that existing safeguards have not consistently deterred staff from unlawfully viewing sensitive records.
“Having the ability to view a record is not the same as having a legitimate need to do so. Every member of staff has a personal responsibility to respect that boundary…” Arnold added.
Artificial intelligence is becoming increasingly powerful, a fact highlighted with the US government’s recent instruction to limit access to Anthropic’s Claude Mythos model.
Now, the CEO of JPMorgan has described the risks the technology poses as a “real issue,” and likened wide access to the AI as “giving ballistic missiles to individuals.”
Speaking at the Pennsylvania Defense and Innovation Summit, JPMorgan’s Jamie Dimon underscored the risks posed by the AI, which has already been shown to both identify and exploit cybersecurity challenges.
Currently, Claude Mythos is limited to a small selection of organizations, companies, and federal and military departments. Public access to the AI has been blocked, and worldwide access has been blocked due to the potential security issues of this powerful AI.
Claude Mythos is not the type of threat that can become self-aware and take over military appliances like the fictional Skynet of the Terminator movie series. However, it does have the capacity to cause immense damage in the wrong hands.
The AI is capable of detecting cybersecurity vulnerabilities and reporting on them; it is also able to generate automatic exploits. So, for white hat cybersecurity analysts, it is a powerful defensive tool, but in the wrong hands, it is a destructive power. In addition, its automated capabilities make it easy for black hats to scale their cybercrime operation and make ransomware, phishing, and other data-based scams more profitable.
It isn’t just cybersecurity where Anthropic’s Claude Mythos AI has demonstrated such incredible capacities. Scientific research, specifically biology, can be targeted by attackers using AI to turn complex concepts into terms, potentially to misuse the information.
There is also the challenge of a strategic imbalance between single nations or bodies having exclusive access to the technology.
Given the security considerations, it seems unlikely that Claude Mythos will be publicy available anytime soon. However, Anthropic has already stated that it intends Mythos-level features and capabilities to become more widely available.
For this to happen, however, it needs to develop and apply various safeguards.
The most likely scenario is that public access to Mythos is eventually unblocked, with restrictions to specific features that relate to cybersecurity and biological/medical tasks and research.
Project Glasswing is already in operation with a handful of key partners (including Amazon Web Services, Anthropic, Apple, Broadcom, Cisco, CrowdStrike, and others), and will probably be expanded until the safeguards are demonstrated to be fit for purpose, and public use.
Via Reuters
Hackers managed to find their way into the US Department of Homeland Security's primary information sharing platform, gaining unfettered access to the HSIN network that hosts unclassified information that multiple US agencies and international rely on.
The hack allowed the attackers to modify server files, run malicious code and steal credential files while installing backdoors and deleting logs to remove their digital footprint.
Their movements were flagged twice by automated systems and analysts in May 2026, before being dismissed as a false positive each time before an active breach was declared a month later.
The timing and specifics of this intrusion are, in particular, details which could prove to be embarrassing for the US government.
Not only does the HSIN network serve as a key intelligence-sharing tool for both domestic and international partners during the FIFA World Cup, but it also hosts information on other major events, such as America250.
The fact that the hack was picked up not once, but twice by flags before being dismissed as a false positive raises competency concerns for an instance that has already sparked interest, with the House Homeland Security Committee staff having already requested a briefing on the intrusion.
The DHS, for its part, is downplaying the incident, with a spokesperson confirming it but characterizing it narrowly: the department is "aware of a recent cyber incident involving a specific, unclassified legacy information sharing environment" and states there is no indication that classified networks were affected.
This viewpoint is countered by Senate Intelligence Committee Vice Chairman Mark Warner, who argued the platform's sensitivity outstrips its classification level, saying that the information in HSIN, "while not classified, is highly sensitive, and its exposure risks national security."
Investigators have yet to identify or assign blame to a particular hacking group or organization, adding to the chaos in determining motive. The hackers have deleted logs on servers, which only adds to the confusion here.
The important question, perhaps, is not how the breach happened, but why confusion and mischaracterization of the security lapse allowed it to become a much bigger issue than it would have been if it had been contained from the start. Despite security flags and analysts highlighting the breach as early as the 15th of May, the hackers essentially had free rein to operate until at least the 3rd of June thanks to initial reports being dismissed as false positives.
HSIN as a platform handles event security planning, interagency coordination, threat information, and details on persons of interest. Whether any of that material was actually copied remains unknown. Investigators have not determined what, if anything, was exfiltrated, though the theft of credential files is itself telling: attackers who steal credentials are, almost by definition, trying to reach systems and accounts beyond their initial foothold.
This is not the first time HSIN has been compromised, with two documented previous incidents, including a compromised account in 2009 and misconfigured access in 2023, that have resulted in intentional and unintentional breaches of the network.
The issue is only exacerbated by the fact that the DHS, along with its cybersecurity agency, CISA, has absorbed significant workforce cuts over the past year, potentially weakening its defenses against sophisticated hacks that require manual human intervention or oversight to detect, even when the correct flags (which triggered as intended) are already in place.
Such manpower shortages have also been politically polarizing in the US Congress and may be highlighted when the department provides more detailed information about the hack in the coming days, even as the Pentagon deals with its own OPSEC issues that are also being aired in the same forum.
Via DefenseOne
Long before Taco Tuesday became part of the pop-culture vernacular, Tuesdays were synonymous with security — and for anyone in the tech world, they still are. Patch Tuesday, as you most likely know, refers to the day each month when Microsoft releases security updates and patches for its software products — everything from Windows to Office to SQL Server, developer tools to browsers.
The practice, which happens on the second Tuesday of the month, was initiated to streamline the patch distribution process and make it easier for users and IT system administrators to manage updates. Like tacos, Patch Tuesday is here to stay.
In a blog post celebrating the 20th anniversary of Patch Tuesday, the Microsoft Security Response Center wrote: “The concept of Patch Tuesday was conceived and implemented in 2003. Before this unified approach, our security updates were sporadic, posing significant challenges for IT professionals and organizations in deploying critical patches in a timely manner.”
Patch Tuesday will continue to be an “important part of our strategy to keep users secure,” Microsoft said, adding that it’s now an important part of the cybersecurity industry. As a case in point, Adobe, among others, follows a similar patch cadence.
Patch Tuesday coverage has also long been a staple of Computerworld’s commitment to provide critical information to the IT industry. That’s why we’ve gathered together this collection of recent patches, a rolling list we’ll keep updated each month.
In case you missed a recent Patch Tuesday announcement, here are the latest six months of updates.
Microsoft addressed 722 CVEs this month once the 427 Chromium upstream relays are set aside — roughly three times a normal cycle and one of the largest single months in recent memory. Two vulnerabilities arrive under active exploitation: an elevation of privilege in Active Directory Federation Services (CVE-2026-56155), and an elevation of privilege in SharePoint Server (CVE-2026-56164). A third, a BitLocker security feature bypass (CVE-2026-50661) is publicly disclosed but not yet exploited.
The July 2026 Patch Tuesday earns Patch Now recommendations for Windows, Office, Exchange, and SQL Server. SharePoint has two critical RCEs on top of its exploited zero-day, and Exchange Server returns with a critical on-premises spoofing flaw. Adding to our (dear) administrator’s efforts, SharePoint Server 2016/2019 and SQL Server 2016 all reach end of support today. The Readiness team has provided a handy infographic of the expected risk profile of this month’s Patch Tuesday updates.
More info is available here on Microsoft Security updates for July 2026.
Microsoft this month released 206 updates affecting Windows, Office, Exchange Server, and its developer tools — including three Windows vulnerabilities already publicly disclosed. That trio includes an elevation of privilege in the Collaborative Translation Framework (CVE-2026-45586), a denial of service in HTTP.sys (CVE-2026-49160), and a BitLocker security feature bypass (CVE-2026-50507). At the moment, none appear to be under active exploitation, but all three are rated “Exploitation More Likely.”
Even without an exploited zero-day, the June 2026 Patch Tuesday release requires Patch Now recommendations for Windows, Office, and Exchange. The latter is back in the patch picture with a consolidated security update that Microsoft recommends installing “as soon as possible.”
More info is available here on Microsoft Security updates for June 2026.
Microsoft this month released 139 updates affecting Windows, Office, .NET, and SQL Server (though there were no updates for Microsoft Exchange Server). Despite the absence of zero-days, the May Patch Tuesday update still requires Patch Now recommendations for Windows and Office.
The combination of three unauthenticated network RCEs (Netlogon, DNS Client, and SSO Plugin for Jira and Confluence), four Word Preview Pane RCEs, the large TCP/IP vulnerability cluster, and the carry-over BitLocker recovery condition (still active on Windows 10 and Windows Server) warrants an accelerated deployment release schedule.
More info is available here on Microsoft Security updates for May 2026.
Windows admins are going to be busy this month, dealing with the largest Patch Tuesday cycle in memory. The April release involves 165 updates and roughly 340 unique CVEs from Microsoft — including two zero-days, one of which is already being actively exploited in the wild.
The Readiness team recommends “Patch Now” schedules for nearly every major product family: Windows, Office (with a zero-day), Microsoft Edge (Chromium), SQL Server, and Microsoft Developer Tools (.NET). April also brings Phase 2 of Microsoft’s Kerberos RC4 hardening with full enforcement set for July. There is a lot to cover, so here’s a useful infographic mapping the deployment risk for each platform.
More info is available here on Microsoft Security updates for April 2026.
Microsoft’s March Patch Tuesday release addresses 83 vulnerabilities across Windows, Office, SQL Server, Azure, and .NET — with two publicly disclosed zero-days affecting SQL Server and .NET (though neither is being actively exploited in the wild.) Six additional vulnerabilities spanning the Windows Kernel, Graphics Component, SMB Server, Accessibility Infrastructure, and Winlogon are flagged as “Exploitation More Likely.”
The most significant change this month is the introduction of Common Log File System (CLFS) hardening with signature verification, which will affect how Windows handles log files across the operating system. More info on Microsoft Security updates for March 2026.
The company’s Patch Tuesday release for February addresses 59 CVEs across the company’s product family — roughly half the volume of January’s 159 patches. Six vulnerabilities, affecting Windows Shell, MSHTML, Desktop Window Manager, Remote Desktop, Remote Access, and Microsoft Word, are already being actively exploited. (All five Critical-rated CVEs target Azureservices rather than Windows, however.)
Both Windows and Office get a “Patch Now” recommendation, with CISA setting a March 3 enforcement deadline for all six exploited vulnerabilities. Two new enforcement timelines also take effect in April: Kerberos RC4 deprecation (CVE-2026-20833) and Windows Deployment Services hardening (CVE-2026-0386). More info on Microsoft Security updates for February 2026.
CISOs at government organizations and universities have an unexpected ally coming to their aid: OnlyFans models.
For some time, hackers have exploited weaknesses in the websites of universities or government departments to host scams or malware, using content stolen from the OnlyFans website as bait to attract victims.
Now, according to security researchers at Upguard, the fightback has begun: creators of adult content on OnlyFans are leveraging Google search results and the protection offered by copyright law to break up the traffic distribution systems created by bad actors.
These distribution systems work in three stages: entry points using adult or other content to attract and capture web traffic, a routing system sends it to destination sites, and those sites monetize the traffic through scams and malware. It has proved to be a lucrative business for the scammers.
Google recognizes the approach and calls such actors SEO parasites as they benefit from the reputations of other organizations — in particular government or academic sites, which Google views as having high authority.
Since the creators of OnlyFans content are also the copyright holders, they are able to issue Digital Millennium Copyright Act (DMCA) take-down notices for the stolen content posted by the bad actors to other sites. Upguard was able to track this through Google’s DMCA Transparency Report, and through the Lumen Database, another tracker of takedown notices, to which it was granted research access.
“This allows us to identify likely compromised sites: government and university domains advertising unlicensed adult content,” Upguard said.
The OnlyFans creators’ action has two benefits for the operators of the affected websites: The adult content associated with their domain disappears from Google search results, no longer affecting their reputation — and if they receive takedown notices for such content they can check their webservers for the vulnerabilities that enabled the bad actors to post it there in the first place.
This article first appeared on CSO.
Microsoft addressed 722 CVEs this month once the 427 Chromium upstream relays are set aside — roughly three times a normal cycle and one of the largest single months in recent memory. Two vulnerabilities arrive under active exploitation: an elevation of privilege in Active Directory Federation Services (CVE-2026-56155), and an elevation of privilege in SharePoint Server (CVE-2026-56164). A third, a BitLocker security feature bypass (CVE-2026-50661) is publicly disclosed but not yet exploited.
The July 2026 Patch Tuesday earns Patch Now recommendations for Windows, Office, Exchange, and SQL Server. SharePoint has two critical RCEs on top of its exploited zero-day, and Exchange Server returns with a critical on-premises spoofing flaw. Adding to our (dear) administrator’s efforts, SharePoint Server 2016/2019 and SQL Server 2016 all reach end of support today. The Readiness team has provided a handy infographic of the expected risk profile of this month’s Patch Tuesday updates.
(More information about recent Patch Tuesday releases is available here.)
The July release note flags known issues against the following updates:
Windows Update can still replace manually installed graphics drivers with older OEM versions from the catalogue (the four-part Hardware ID ranking issue acknowledged on the Hardware Dev Center). The two-part HWID pilot runs to September 2026.
Between the June and July Patch Tuesdays, MSRC Security Update Guide notices updated 651 reported CVEs across six notification dates (15, 19, 26 June and 3, 8, 11 July), 532 of them routine Chromium upstream re-publications. Of the roughly 30 Microsoft revisions, almost all were cross-platform Office catch-up with no bearing on a Windows enterprise estate. No further action required for IT administrators for this Windows update cycle.
This is the deadline cycle June pointed at. The July end-of-support wave lands today, and it collides with the month’s heaviest patching. SharePoint and SQL Server take some of their most active security updates ever on platforms receiving their last.
The 2011 Secure Boot certificate expiries have now passed; devices that never took the Windows UEFI CA 2023 key updates under CVE-2023-24932 can no longer receive updated boot components, with the Windows Production PCA for the boot manager still ahead on 19 October 2026. Kerberos RC4 hardening (CVE-2026-20833) has been in enforcement since April 2026; the July 2026 update removes the RC4DefaultDisablementPhase rollback control that let administrators defer it, making enforcement final.
Microsoft’s July 2026 Patch Tuesday is a security-only release: 180 test-guidance entries, 14 of them high risk (June had one). Printing and graphics are the centre of gravity: win32kfull.sys, the kernel-mode window manager, is the most-patched binary (14 entries), and seven high-risk flags sit alongside it – the Print Spooler, four win32k entries, and two GDI+ metafile entries. NTFS is the second theme, with 10 entries, two high risk. Every entry reports no functional changes – it’s pure regression validation. The packages span Windows 11 26H1 back to Server 2012 ESU.
The Print Spooler flag centres on shared printers, whose queue status must track jobs accurately; the win32k flags cover 32-bit application printing, font rendering in printed and exported output, on-screen rendering, and window management; the GDI+ flags cover metafiles.
Both NTFS high-risk flags target integrity – extended attributes, and volume recovery after an unexpected shutdown. File History carries its own high-risk flag on clients. A Windows Server 2025-only bundle across boot, BitLocker, and ReFS demands the full Secure Boot/BitLocker matrix. Eight entries hit Server 2025 alone, including WSL, GPU partitioning, and a scripted Windows Server Backup pass repeating recovery after rolling the date 90 days forward.
Three further high-risk flags land here: HID input (hidparse.sys with win32k) – touch, keyboard, mouse, touchpad, through disconnects and restarts; the WinSock bundle (afd.sys plus Bluetooth and multicast drivers); and IrDA. The heaviest ask is not high risk at all: the NetAdapterCx driver (24H2/25H2, Server 2025) wants 500-plus adapter enable-disable cycles under Driver Verifier.
Windows Installer itself is patched: testing should include application install, uninstall, repair, and force a rollback. Hyper-V wants virtual-switch traffic as part of its testing exercises with Virtual Filtering Platform policies enforced. Sixteen media-related security entries cover playback, HEVC and MPEG-TS, USB audio, and MIDI 2.0.
These two entries are a little different from the rest of the cycle: they ask you to confirm a security behaviour actively works, not just that nothing regressed. A pass here means the protection fired, so treat them as functional checks rather than box-ticking.
July’s Office wave is security-only; everything landed on 14 July, and nothing critical or non-security shipped in the 7 July preview. It’s an MSI-only cycle, so Click-to-Run estates can sit this one out.
Mind the rollback rules before you schedule the window: most client updates can be uninstalled, but the server updates cannot and always require a reboot.
The developer estate gets a broad but low-drama sweep this month. Both .NET and SQL Server patch widely, but the ask is representative-application validation rather than anything exotic – install on the matching branch and confirm normal behaviour.
The Readiness team recommends the following priorities for your larger enterprise deployments:
Each month, we break down the update cycle into product families (as defined by Microsoft) with the following basic groupings:
Edge has had a busier month than usual. Microsoft addressed 46 Microsoft Edge (Chromium-based) CVEs this cycle. None critical, but heavily weighted to remote code execution (21 entries) and spoofing (13), led by CVE-2026-58289, a remote code execution flaw. A run of further RCEs (CVE-2026-57981, CVE-2026-56645, CVE-2026-57974) follows.
The Chromium volume looks (quite) alarming but is routine plumbing: it flows to Edge through its own auto-update channel. Add these browser (Edge) updates to your standard release schedule for your managed environments.
Windows carries the bulk of this month’s updates: 406 CVEs, 31 rated critical and 374 important. Elevation of privilege dominates by volume (226 entries), followed by remote code execution (70), information disclosure (70), denial of service (23), and a scatter of security-feature-bypass, tampering, and spoofing entries across the following feature groupings:
The Windows Kernel is the most-patched component (28 CVEs, seven “More Likely”), followed by NTFS (21), Windows Runtime (17), Windows Media (14), ReFS (12), and Win32k (15 across its two entries). Add this Windows update to your Patch Now deployment schedule.
Microsoft released 96 Office CVEs this month: 19 critical, 76 important. Remote code execution leads (53 entries), ahead of information disclosure (27) and spoofing (10). SharePoint is the centre of gravity: it touches 39 of the 96 CVEs and supplies the family’s one actively exploited flaw.
With an exploited zero-day, two RCEs, and an end-of-support deadline all landing on SharePoint in the same cycle, SharePoint environments are the priority. Add the July Office and SharePoint updates to your Patch Now schedule.
Both Exchange and SQL Server carry critical-rated security vulnerabilities this month. Exchange Server returns with an on-premises security update for Exchange Server Subscription Edition, the only on-premises release still supported after Exchange Server 2016 and 2019 reached end of support in October 2025; SQL Server takes two critical remote code execution flaws, one of them against SQL Server 2016, which reaches end of support on the same day.
Both belong on the Patch Now schedule this month: the Exchange on-premises update for its critical spoofing flaw, and the SQL Server update for the two critical RCEs.
Microsoft released 24 CVEs across its developer tooling this month, all rated important. The weighting shifts from last month’s Visual Studio Code concentration toward .NET and ASP.NET Core, where a run of denial-of-service entries dominates the volume:
Add these Microsoft updates to your standard developer update release schedule.
Outside Microsoft’s own catalogue, July is quiet. Adobe issued no Acrobat or Reader security updates. So, the month belongs to Microsoft, and it is a heavy one: 722 CVEs, roughly three times a normal cycle and one of the largest on record. Worth noting that this lands in the same season Microsoft has been talking up AI-assisted vulnerability management, and the AI stack it is selling as the answer, Copilot and Azure OpenAI among them, sits in the centre of this patch cycle’s own critical-rated updates. The (AI) tooling may be getting smarter, but the patch pile is (definitely) not getting smaller. This may be the beginning of an accelerating curve of ever larger patch cycles. My feeling is that we are in the middle of the beginning of this coming patch surge.
This article is published as part of the Foundry Expert Contributor Network.
Want to join?
Login